CyberShield Advisory
The Cybersecurity Risks of File Sharing
Sharing a document with a client takes seconds, and a forgotten link can stay open for years. This guide explains where file sharing goes wrong and what firms can do about it.
The short version
Professional firms share files all day: drafts, deliverables, financial records, signed agreements. Cloud sharing in tools such as Microsoft 365 makes that fast and convenient. It also makes it easy to share more than intended, with more people than intended, for longer than intended. The risk is often less one dramatic mistake than many small, forgotten shares.
Where file sharing goes wrong
- Links that anyone can use. A link that works for anyone who holds it can be forwarded, posted, or found in a compromised mailbox. The person who created it may not remember it exists.
- Links that never expire. A share created for a project in one year may still open the files years later.
- Whole folders instead of single files. Sharing the folder for convenience can expose documents that were never meant to be seen.
- Access that outlives the relationship. When an engagement ends, the client contacts, outside experts and former staff may still have access.
- Guests nobody reviews. External users invited into your environment can accumulate with no owner and no schedule to check them.
- Personal accounts and email attachments. Files sent to personal addresses or copied to unmanaged devices leave your control entirely.
- Weak sign-in on the other end. A share is only as safe as the account of the person receiving it.
What helps
- Decide the rules. Who may share outside the firm, what kinds of material need extra approval, and what the default should be.
- Prefer named recipients. Links limited to specific people are generally safer than links open to anyone who has them.
- Set expiry. Where your settings allow it, give external shares an end date and renew them deliberately.
- Share the smallest unit. A single file or a purpose-built folder, not the matter's whole library.
- Review on a schedule. Look at what is shared externally and who the guests are, at least when an engagement closes.
- Protect the most sensitive material. Where available, labels and data loss prevention can restrict sharing of confidential content.
- Require strong sign-in. Multifactor authentication for your own staff reduces the chance that a stolen account becomes a sharing channel.
Questions to ask this week
- Can we list what is currently shared outside the firm?
- Do external links have expiry dates?
- Who owns the review of guest accounts?
- What happens to a client's access when the engagement ends?
Take the next step
Our free Microsoft 365 security assessment asks five quick questions, including who your files can be shared with, and shows where to start. It is a short check, not a full review of your settings.